feat(skill): 本地 git 门禁 + 项目级安装 + 覆盖率与第三方扫描

- hooks/git/{pre-commit,pre-push} + scripts/install-git-hooks.sh（Gitea Actions 无 runner，本地兜底）
- install-skills.sh: --scope project --project-dir（装到项目 .agents/skills）
- scripts/scan-installed.sh: 扫第三方已装技能（33 个，0 高危）
- generate-catalog: has_evals/has_docs + coverage；validate --coverage + 路由一致性检查
- SCOPE 覆盖率路线图（3-4 周补齐 40 个技能的 evals 与四段式文档）
- MAINTENANCE/README/CHANGELOG 同步

install-skills.sh

@@ -10,6 +10,8 @@
 #   --audit             Show installed vs repo versions for the selected target
 #   --include-beta      Also install skills whose plugin.json status=beta
 #   --no-validate       Skip scripts/validate-skills.py before installing
+#   --scope <scope>     user (default) or project (installs into <project>/.agents/skills)
+#   --project-dir <dir> Project root, required when --scope project
 #   --dry-run           Preview changes without writing anything
 #   --category <cat>    Only install plugins in dir_category=<cat>
 #                       Valid values: biz, core, dev, integration, personal, req
@@ -38,6 +40,8 @@ LINK_MODE=false
 AUDIT_ONLY=false
 INCLUDE_BETA=false
 NO_VALIDATE=false
+SCOPE="user"
+PROJECT_DIR=""
 
 # ── Colour helpers ─────────────────────────────────────────────────────────────
 GREEN='\033[0;32m'
@@ -63,6 +67,12 @@ while [[ $# -gt 0 ]]; do
     --audit)     AUDIT_ONLY=true ;;
     --include-beta) INCLUDE_BETA=true ;;
     --no-validate)  NO_VALIDATE=true ;;
+    --scope)
+      [[ $# -ge 2 ]] || { error "--scope requires user or project"; exit 1; }
+      SCOPE="$2"; shift ;;
+    --project-dir)
+      [[ $# -ge 2 ]] || { error "--project-dir requires a path"; exit 1; }
+      PROJECT_DIR="$2"; shift ;;
     --force)     FORCE=true ;;
     --cleanup)   CLEANUP=true ;;
     --list)      LIST_ONLY=true ;;
@@ -90,7 +100,7 @@ case "$AGENT_TARGET" in
     STATE_FILE="${AI_PROJ_HELPER_STATE_FILE:-${HOME}/.agents/.ai-proj-helper-installed-skills.json}"
     ;;
   dsh)
-    if [[ -z "${DSH_HOME:-}" ]]; then
+    if [[ "$SCOPE" != "project" && -z "${DSH_HOME:-}" ]]; then
       error "--agent dsh requires DSH_HOME (or set AI_PROJ_HELPER_SKILLS_DIR explicitly)"
       exit 1
     fi
@@ -108,6 +118,20 @@ case "$AGENT_TARGET" in
     ;;
 esac
 
+# ── Project scope override ─────────────────────────────────────────────────────
+if [[ "$SCOPE" == "project" ]]; then
+  if [[ -z "$PROJECT_DIR" ]]; then
+    error "--scope project requires --project-dir <project root>"
+    exit 1
+  fi
+  [[ -d "$PROJECT_DIR" ]] || { error "project dir 不存在: $PROJECT_DIR"; exit 1; }
+  PROJECT_DIR="$(cd "$PROJECT_DIR" && pwd)"
+  SKILLS_DIR="$PROJECT_DIR/.agents/skills"
+  COMMANDS_DIR=""
+  STATE_FILE="$PROJECT_DIR/.agents/.ai-proj-helper-installed-skills.json"
+  info "Project scope: $PROJECT_DIR"
+fi
+
 # ── State helpers (plain JSON via python3) ─────────────────────────────────────
 state_get() {
   # state_get <install_name> -> prints version or empty string